Solved

Protecting branch office VPN's...

Posted on 2004-08-30
6
440 Views
Last Modified: 2013-11-16
I am going to create a connection between our HQ and a branch office, I have done this in the past no problem. My question is, what can I do to stop any virus activity from flowing back over the VPN to HQ or vice-versa. All the machines have managed anti-virus and patch protection, I am throwing this senario out as a "what if". Anyways, is there a VPN product that does packet inspection of the VPN tunnels itself? I was going with sonicwall products, as cisco is too complex for our needs at this time. Any ideas?

Thanks in advance!
0
Comment
Question by:cbtech
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 1

Expert Comment

by:Robnhood
ID: 11935057
The only thing that I have heard of that would allow you to do something like this is the cisco security agent.
0
 
LVL 3

Expert Comment

by:CvD
ID: 11936494
Well, I'm no expert, but Googleing "packet inspection of VPN tunnel" got me a ton of info on the subject. Seems there are lots of products (router/firewalls) available now that support this.

Vaya con Dios,
CvD
0
 
LVL 5

Accepted Solution

by:
rsriprac earned 125 total points
ID: 11939872
I would think block out all ports (IPsec) that are not in use on the ends before it is tunneled.  This will provide some layer of protection.  Other then that try:

http://www.fortinet.com/products/

-Ram
0
Create Professional Looking Email Signatures

Create "Professional HTML Email Signatures" with ease.
7 Day Money Back Guarantee if not 100% Satisfied.
Affordable - Try it out for 7 Days Totally Risk Free.
Installers provided for over 45 Email clients.
Both Windows & MAC Supported.
Highly Recommended!

 

Expert Comment

by:nadeem_azhar
ID: 11948604
Look at the SnapGear line of products from CyberGuard.  Real easy to configure and no user limits.   http://www.snapgear.com
Configuring L2TP/IPSEC/PPTP VPN and IPSEC tunnel is a snap.

Regards
0
 
LVL 3

Expert Comment

by:CvD
ID: 11949671
Looking at the comments sofar, go for my solution and decide for yourself.
0
 
LVL 2

Expert Comment

by:mellowmarquis
ID: 11950143
There's a cool appliance called a Packetshaper which allows you to prioritise or drop taffic. It can see through IPSec and VPN's and even prioritise applications within Citrix sessions. It's very cool.

I also find it useful for giving a real-time status of traffic flow and have used it to monitor links to 200 sites by routing all traffic through our co-lo. I prefer to allow traffic to flow so that I can see whats on the wire. As soon as I spot ICMP or some known worm port getting hit, I can turn on monitoring to read which terminals it's coming from and determine exactly which site it's coming from. I'd prefer to get rid of any infections rather than contain them and let them continue to infect vulnerable clients/laptops on the local network.

Check it out:
http://www.packeteer.com/prod-sol/products/packetshaper.cfm

I've never been one to publicly endorse products, but this is a really cool box (and their tech support is very good compared to some)

0

Featured Post

Major Incident Management Communications

Major incidents and IT service outages cost companies millions. Often the solution to minimizing damage is automated communication. Find out more in our Major Incident Management Communications infographic.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Blackberry and SMS logging 5 35
Unable to get rid of Trojans in Windows 7 19 144
Windows 10 Errors 11 114
Certificate Renewal doesn't work Server 2008R2 13 100
This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…
Keystroke loggers have been around for a very long time. While the threat is old, some of the remedies are new!
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

737 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question